Key ceremony

Key takeaways

Key ceremony belongs to science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Key ceremony to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Key ceremony from memory before moving on to harder problems.

Reference excerpt

In cryptography, a key ceremony is a ceremony held to generate or use a cryptographic key. A public example is the signing of the DNS root zone for DNSSEC.

Root key signing ceremony In public-key cryptography and computer security, a root-key ceremony is a procedure for generating a unique pair of public and private root keys. Depending on the certificate policy of a system, the generation of the root keys may require notarization, legal representation, witnesses, or “key-holders” to be present. A commonly recognized practice is to follow the SAS 70 standard for root key ceremonies. At the heart of every certificate authority (CA) is at least one root key or root certificate and usually at least one intermediate root certificate. This “root key” is a unique key that must be generated for secure server interaction with a protective network, often called the "root zone". Prompts for information from this zone can be made through a server. The keys and certificates serve as the credentials and safeguards for the system. These digital certificates are made from a public key and a private key.

Instances The following examples A and B are at opposite ends of the security spectrum, and no two environments are the same. Depending on the level of protection required, different levels of security will be used.

Possibility A: Identification and non-repudiation for email and web access Unless the information that is being accessed or transmitted is valued in terms of millions of dollars, it is generally adequate that the root key ceremony be conducted within the security of the vendor's laboratory. The customer may opt to have the root key stored in a hardware security module, but in most cases, the safe storage of the root key on a CD or hard disk is admissible. The root key is never stored on the CA server.

Possibility B: MRTD Cards and e-Passports Machine Readable Travel Documents (MRTDs) require a much higher level of security. When conducting the root key ceremony, the government or organization will require rigorous security checks on all personnel in attendance. Those normally required to attend the key ceremony include a minimum of two administrators from the organization, two signatories from the organization, one lawyer, a notary, and two video camera operators, in addition to the CA software vendor's technical team.

Overview The actual generation of the root key-pair typically occurs in a secure vault, with no external communication except for a single telephone line or intercom. Upon securing the vault, all present personnel must verify their identity using at least two legally recognized forms of identification. The lawyer in charge logs every person, transaction, and event in a root key ceremony log book, with each page notarized. From the moment the vault door closes until its reopening, everything is also video recorded. The lawyer and the organization's two signatories sign the recording, which is also notarized. As part of the process, the root key is divided into up to twenty-one parts, each secured in a safe with a key and numerical lock. The keys are distributed to up to twenty-one people, and the numerical codes are distributed to another twenty-one people.

Providers The CA vendors and organizations, such as RSA, VeriSign, and Digi-Sign, implement projects of this nature where conducting a root key ceremony would be a central component of their service.

IBM HSM key ceremony A hardware security module (HSM) key ceremony is a procedure where the master key is generated and loaded to initialize the use of the HSM. The master key is at the top of the key hierarchy and is the root of trust to encrypt all other keys generated by the HSM. A master key is composed of at least two parts. Each key part is normally owned by a different person to enhance security.

Master key types The master key is stored within the HSM. IBM HSMs support two types of cryptographic mechanisms:

The PKCS#11 mechanism, called IBM Enterprise PKCS #11 (EP11), creates a high-security solution for application programs developed for this industry-standard API. The IBM Common Cryptographic Architecture (CCA) mechanism provides many functions of special interest in the finance industry, extensive support for distributed key management, and a base on which custom processing and cryptographic functions can be added. Depending on the cryptographic mechanisms that the HSM supports and the key objects that are encrypted by the master key, the following types of master keys are available:

EP11 HSMs EP11 symmetric master key: used to encipher all kinds of sensitive materials, including secret key objects and intermediate state information containing secret key materials. CCA HSMs SYM master key: used to encipher DES symmetric key objects ASYM master key: used to encipher PKA-RSA asymmetric key objects AES master key: used to encipher AES, HMAC symmetric key objects APKA master key: used to encipher PKA-ECC asymmetric key objects

HSM key ceremony types

On-premise HSM Key Ceremony For IBM Z and Linux One Systems, the HSMs are used to perform cryptographic operations. The HSM has 85 domains, with each having its own set of master keys. Before using the system, the HSM Key Ceremony must be conducted to load the master key securely and properly. For EP11 HSMs, the master key parts are stored on smart cards and loaded to the HSM with the Trusted Key Entry (TKE) workstation. For CCA HSMs, the master key parts can be stored either on smart cards or in files on the TKE workstation.

Cloud HSM Key Ceremony EP11 HSM is currently the only type of HSM that supports Key Ceremony in the cloud. Both the cloud command-line interface (CLI) and smart cards are provided to load the master key parts to the cloud HSM. IBM Cloud Hyper Protect Crypto Services is presently the only key management service and cloud HSM in the cloud to provide HSM key ceremony through both CLI and smart cards.

… excerpt ends here. Continue reading the full article.

Worked examples

Example 1 — a first encounter with Key ceremony

Start with the simplest possible case. Write down what Key ceremony claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Key ceremony before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Key ceremony ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Key ceremony

In research: Key ceremony appears in science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Key ceremony in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Key ceremony is common in secondary-school and first-year university syllabi. It links to neighbouring topics Key management, so understanding it makes those chapters shorter.
In everyday life: Look for Key ceremony outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

How to study Key ceremony in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Key ceremony means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Key ceremony out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Key ceremony in simple terms?

In cryptography, a key ceremony is a ceremony held to generate or use a cryptographic key. A public example is the signing of the DNS root zone for DNSSEC.

Why does Key ceremony matter?

Because it connects several science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Key ceremony?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Key ceremony.